ffmpeg.git
15 months agoavformat/mpegts: replace magic descriptor_tag values with defines
Brad Hards [Sat, 10 Oct 2020 06:04:30 +0000 (17:04 +1100)]
avformat/mpegts: replace magic descriptor_tag values with defines

This takes the used values from ISO/IEC 13818-1 Table 2-45 and adds
them to the mpegts.h header. No functional changes.

Signed-off-by: Brad Hards <bradh@frogmouth.net>
Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/udp: remove redundant setting of h->max_packet_size
Zhao Zhili [Wed, 23 Sep 2020 16:15:16 +0000 (00:15 +0800)]
avformat/udp: remove redundant setting of h->max_packet_size

h->max_packet_size is being reset in the following code.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoRevert "aviobuf: Discard old buffered, previously read data in ffio_read_partial"
Marton Balint [Thu, 8 Oct 2020 22:18:07 +0000 (00:18 +0200)]
Revert "aviobuf: Discard old buffered, previously read data in ffio_read_partial"

This is unneeded after 2ca48e466675a8a3630061cd2c15325eab8eda97 and it breaks
ffio_ensure_seekback().

This reverts commit 53c25ee0736497b46bb76064cc2c84c976b2d295.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/libsrt: fix cleanups on failed libsrt_open() and libsrt_setup()
Marton Balint [Fri, 9 Oct 2020 19:37:07 +0000 (21:37 +0200)]
avformat/libsrt: fix cleanups on failed libsrt_open() and libsrt_setup()

- Call srt_epoll_release() to avoid fd leak on libsrt_setup() error.
- Call srt_cleanup() on libsrt_open() failure.
- Fix return value and method on mode parsing failure.

Based on a patch by Nicolas Sugino <nsugino@3way.com.ar>.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavfilter/af_aiir: use transposed II form for biquad sections
Paul B Mahol [Fri, 16 Oct 2020 20:51:16 +0000 (22:51 +0200)]
avfilter/af_aiir: use transposed II form for biquad sections

15 months agoavfilter/af_aiir: implement parallel processing
Paul B Mahol [Thu, 15 Oct 2020 15:29:04 +0000 (17:29 +0200)]
avfilter/af_aiir: implement parallel processing

15 months agoavcodec/av1dec: add cur_frame.spatial_id and temporal_id to AV1Frame
James Almer [Fri, 16 Oct 2020 16:34:31 +0000 (13:34 -0300)]
avcodec/av1dec: add cur_frame.spatial_id and temporal_id to AV1Frame

Will be used by hwaccels, which have access to a frame's AV1RawFrameHeader but not
its AV1RawOBUHeader.

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agotools/target_dem_fuzzer: Set format independent of c
Michael Niedermayer [Fri, 16 Oct 2020 09:36:26 +0000 (11:36 +0200)]
tools/target_dem_fuzzer: Set format independent of c

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/movtextenc: cosmetics
Andriy Gelman [Wed, 14 Oct 2020 21:27:16 +0000 (17:27 -0400)]
avcodec/movtextenc: cosmetics

Change pointer position.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
15 months agoavcodec/movtextenc: fix writing to bytestream on BE arches
Andriy Gelman [Wed, 14 Oct 2020 04:38:22 +0000 (00:38 -0400)]
avcodec/movtextenc: fix writing to bytestream on BE arches

Fixes fate-binsub-movtextenc on PPC64

Currently tags are written in reverse order on BE arches. This is fixed
by using MKBETAG() and AV_RB32() to be arch agnostics.

Also s->font_count is of type int. On BE arches with 32bit int,
count = AV_RB16(&s->font_count) will read two most significant bytes
instead of the least significant bytes. This is fixed by assigning
s->font_count to count first.

The final change is modifying the type of len. On BE arches
the most significant byte of the int was written instead of the least
significant byte.

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
15 months agoavcodec/asvenc: Inline constants
Andreas Rheinhardt [Mon, 12 Oct 2020 21:22:27 +0000 (23:22 +0200)]
avcodec/asvenc: Inline constants

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/asvdec: Use init_get_bits8()
Andreas Rheinhardt [Mon, 12 Oct 2020 09:09:27 +0000 (11:09 +0200)]
avcodec/asvdec: Use init_get_bits8()

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/asvdec: Reduce the size of some VLCs
Andreas Rheinhardt [Mon, 12 Oct 2020 08:48:29 +0000 (10:48 +0200)]
avcodec/asvdec: Reduce the size of some VLCs

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/ylc: Inline constants
Andreas Rheinhardt [Tue, 13 Oct 2020 08:50:42 +0000 (10:50 +0200)]
avcodec/ylc: Inline constants

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/v3/408enc: Remove empty close functions
Andreas Rheinhardt [Tue, 13 Oct 2020 07:08:32 +0000 (09:08 +0200)]
avcodec/v3/408enc: Remove empty close functions

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/exr: Fix overflow with many blocks
Michael Niedermayer [Sat, 26 Sep 2020 19:58:37 +0000 (21:58 +0200)]
avcodec/exr: Fix overflow with many blocks

Fixes: signed integer overflow: 1073741827 * 8 cannot be represented in type 'int'
Fixes: 25621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-6304841641754624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/Makefile: add missing av1_cuvid entry
James Almer [Thu, 15 Oct 2020 21:30:04 +0000 (18:30 -0300)]
avcodec/Makefile: add missing av1_cuvid entry

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoconfigure: check for nvdec/cuvid AV1 support
Timo Rothenpieler [Thu, 15 Oct 2020 21:25:05 +0000 (23:25 +0200)]
configure: check for nvdec/cuvid AV1 support

15 months agoavcodec/vp9dsp_template: Fix integer overflows in idct16_1d()
Michael Niedermayer [Sat, 19 Sep 2020 14:40:22 +0000 (16:40 +0200)]
avcodec/vp9dsp_template: Fix integer overflows in idct16_1d()

Fixes: signed integer overflow: -190760 * 11585 cannot be represented in type 'int'
Fixes: 25471/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VP9_fuzzer-5743354917421056

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/ansi: Check initial dimensions
Michael Niedermayer [Sat, 19 Sep 2020 19:17:32 +0000 (21:17 +0200)]
avcodec/ansi: Check initial dimensions

Fixes: Timeout (minutes to less than 1sec)
Fixes: 25682/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ANSI_fuzzer-6320712032452608

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset
Michael Niedermayer [Sat, 19 Sep 2020 14:29:15 +0000 (16:29 +0200)]
avcodec/hevcdec: Check slice_cb_qp_offset / slice_cr_qp_offset

Fixes: signed integer overflow: 29 + 2147483640 cannot be represented in type 'int'
Fixes: 25413/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5697909331591168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/sonic: Check for overread
Michael Niedermayer [Sat, 19 Sep 2020 09:29:01 +0000 (11:29 +0200)]
avcodec/sonic: Check for overread

Fixes: Timeout (too long -> 1.3 sec)
Fixes: 24358/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SONIC_fuzzer-5107284099989504

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mobiclip: Check that Motion vectors are within the input frame
Michael Niedermayer [Fri, 2 Oct 2020 20:48:12 +0000 (22:48 +0200)]
avcodec/mobiclip: Check that Motion vectors are within the input frame

The MV checks did not consider the width and height of the block, also they
had some off by 1 errors. This resulted in undefined behavior and crashes.
This commit instead errors out on these

Fixes: out of array read
Fixes: 26080/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5758146355920896

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mobiclip: set the bitstream size to the input
Michael Niedermayer [Sat, 12 Sep 2020 14:35:55 +0000 (16:35 +0200)]
avcodec/mobiclip: set the bitstream size to the input

Fixes: out of array read
Fixes: 25453/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5163575973511168

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/allcodecs: move av1_cuvid below libaom_av1
James Almer [Thu, 15 Oct 2020 20:29:27 +0000 (17:29 -0300)]
avcodec/allcodecs: move av1_cuvid below libaom_av1

Software decoders should always be first.

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoavcodec/cuviddec: add av1 support
Roman Arzumanyan [Thu, 3 Sep 2020 11:52:08 +0000 (14:52 +0300)]
avcodec/cuviddec: add av1 support

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
15 months agoavformat/subviewerdec: fail on AV_NOPTS_VALUE
Michael Niedermayer [Sun, 19 Jul 2020 15:13:10 +0000 (17:13 +0200)]
avformat/subviewerdec: fail on AV_NOPTS_VALUE

Such values are not supported by ff_subtitles_queue*

Fixes: signed integer overflow: 10 - -9223372036854775808 cannot be represented in type 'long'
Fixes: 24193/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5714901855895552

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agolibavformat/avidec: check memory allocation
Chris Miceli [Tue, 13 Oct 2020 03:22:25 +0000 (14:22 +1100)]
libavformat/avidec: check memory allocation

Memory allocation for AVIOContext should be checked. In this code,
all error conditions are sent to the "goto error".

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agolibavfilter/dnn/dnn_backend{openvino, tf}: check memory alloc non-NULL
Chris Miceli [Wed, 14 Oct 2020 00:59:44 +0000 (11:59 +1100)]
libavfilter/dnn/dnn_backend{openvino, tf}: check memory alloc non-NULL

These previously would not check that the return value was non-null
meaning it was susceptible to a sigsegv. This checks those values.

15 months agolibavfilter/dnn_backend_native: check mem allocation
Chris Miceli [Wed, 14 Oct 2020 00:19:50 +0000 (11:19 +1100)]
libavfilter/dnn_backend_native: check mem allocation

check that frame allocations return non-null.

15 months agoavcodec/webp: Use LE VLC table for LE bitstream reader
Andreas Rheinhardt [Mon, 12 Oct 2020 07:05:42 +0000 (09:05 +0200)]
avcodec/webp: Use LE VLC table for LE bitstream reader

The WebP format uses Huffman tables and the decoder therefore uses
VLC tables. Given that WebP is a LE format, a LE bitreader is used;
yet the VLC table is not created for a LE reader (the process used to
create the tables puts the last bit to be read in the lowest bit) and
therefore custom code for reading the VLCs that reverses the bits
read is used instead of get_vlc2(). This commit changes this to use
a table designed for LE bitreader which allows to use get_vlc2() directly.
The necessary reversing of the codes is delegated to
ff_init_vlc_sparse() (and is therefore only done during init and not
when actually reading the VLCs).

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/ivi: Avoid reversing BE VLC codes for LE bitstream reader
Andreas Rheinhardt [Mon, 12 Oct 2020 05:45:23 +0000 (07:45 +0200)]
avcodec/ivi: Avoid reversing BE VLC codes for LE bitstream reader

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/speedhq: Avoid reversing BE codes for LE bitstream reader
Andreas Rheinhardt [Mon, 12 Oct 2020 03:59:34 +0000 (05:59 +0200)]
avcodec/speedhq: Avoid reversing BE codes for LE bitstream reader

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/vlc, bitstream: Allow to use BE codes to initialize LE VLC
Andreas Rheinhardt [Mon, 12 Oct 2020 03:24:42 +0000 (05:24 +0200)]
avcodec/vlc, bitstream: Allow to use BE codes to initialize LE VLC

This is easily possible because ff_init_vlc_sparse() already transforms
both LE as well as BE codes to a normal form internally before
processing them further. This will be used in subsequent commits.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/speedhq: Don't use ff_ prefix for static symbols
Andreas Rheinhardt [Mon, 12 Oct 2020 02:21:17 +0000 (04:21 +0200)]
avcodec/speedhq: Don't use ff_ prefix for static symbols

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/speedhq: Don't pretend reading DC can fail
Andreas Rheinhardt [Mon, 12 Oct 2020 02:08:07 +0000 (04:08 +0200)]
avcodec/speedhq: Don't pretend reading DC can fail

It can't, because the tables used don't have any loose ends. This also
fixes a bug in the only caller of decode_dc_le(): It didn't check the
return value.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/indeo2: Remove #ifdef BITSTREAM_READER_LE cruft
Andreas Rheinhardt [Mon, 12 Oct 2020 01:49:05 +0000 (03:49 +0200)]
avcodec/indeo2: Remove #ifdef BITSTREAM_READER_LE cruft

Before the LE bitstream reader was used in the Indeo 2 decoder,
a standard BE bitstream reader with swapped bits was used; when the LE
bitstream reader was added, the old code was only #ifdef'ed away and not
removed. Said code has several problems: It modifies the input packet
without ensuring that the packet is indeed writable; and it doesn't work
since 09c4e5c5988c0037d108c5fc2a137d9ad488f7f4 because said commit
removed the BE table used to initialize the VLC table. So just remove
this cruft from the actual decoder, too.

Also use INIT_LE_VLC_STATIC while at it.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavfilter/vf_scale_cuda: unload cuModule on uninit
leozhang [Mon, 12 Oct 2020 11:59:39 +0000 (19:59 +0800)]
avfilter/vf_scale_cuda: unload cuModule on uninit

Signed-off-by: leozhang <nowerzt@gmail.com>
Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
15 months agoAdd support for building fuzzer tools for an individual demuxer
Michael Niedermayer [Sat, 10 Oct 2020 15:25:46 +0000 (17:25 +0200)]
Add support for building fuzzer tools for an individual demuxer

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agofate-mxf-probe-applehdr10: Ignore endianness
Tomas Härdin [Mon, 5 Oct 2020 08:17:13 +0000 (10:17 +0200)]
fate-mxf-probe-applehdr10: Ignore endianness

15 months agoavcodec/cbs_av1: Free content in cbs_av1_free_metadata()
Michael Niedermayer [Sun, 11 Oct 2020 13:22:51 +0000 (15:22 +0200)]
avcodec/cbs_av1: Free content in cbs_av1_free_metadata()

Fixes: memleak
Fixes: 25838/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5736255957237760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavfilter/af_sofalizer: allow up to 64 channels
Paul B Mahol [Mon, 12 Oct 2020 10:15:27 +0000 (12:15 +0200)]
avfilter/af_sofalizer: allow up to 64 channels

15 months agoavfilter/af_sofalizer: allow to specify virtual speakers indetifier as number
Paul B Mahol [Sun, 11 Oct 2020 13:23:31 +0000 (15:23 +0200)]
avfilter/af_sofalizer: allow to specify virtual speakers indetifier as number

15 months agoavcodec/apedec: use proper macro and type for pivot variable
Paul B Mahol [Mon, 5 Oct 2020 23:56:43 +0000 (01:56 +0200)]
avcodec/apedec: use proper macro and type for pivot variable

15 months agoavcodec/apedec: properly calculate and store absolute value
Paul B Mahol [Mon, 5 Oct 2020 23:24:42 +0000 (01:24 +0200)]
avcodec/apedec: properly calculate and store absolute value

15 months agoavcodec/apedec: fix decoding 24bit insane files with recent versions
Paul B Mahol [Mon, 5 Oct 2020 20:24:13 +0000 (22:24 +0200)]
avcodec/apedec: fix decoding 24bit insane files with recent versions

15 months agoavformat/isom: add support for RAW ASC Bayer BGGR in mov
Paul B Mahol [Thu, 8 Oct 2020 17:24:11 +0000 (19:24 +0200)]
avformat/isom: add support for RAW ASC Bayer BGGR in mov

15 months agoavcodec/mpeg12: Don't pretend reading dct_dc_size_* VLCs can fail
Andreas Rheinhardt [Thu, 8 Oct 2020 15:54:19 +0000 (17:54 +0200)]
avcodec/mpeg12: Don't pretend reading dct_dc_size_* VLCs can fail

It can't because the corresponding trees don't have any loose ends.

Removing the checks also removed an instance of av_log(NULL (with a
nonsense message) from the codebase.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/mpeg12: Reduce size of motion-vector VLC
Andreas Rheinhardt [Thu, 8 Oct 2020 14:59:40 +0000 (16:59 +0200)]
avcodec/mpeg12: Reduce size of motion-vector VLC

It currently uses 9 bits per table, but there are no codes with
nine bits at all, while there are codes with eight, ten and eleven bits.
So reducing the table size to eight bits will not reduce the amount of
codes that can be parsed in the first step, but it allows to reduce the
size of the motion-vector VLC.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agolavc, lavf: Remove newlines from calls to avpriv_request_sample().
Carl Eugen Hoyos [Sun, 11 Oct 2020 17:59:24 +0000 (19:59 +0200)]
lavc, lavf: Remove newlines from calls to avpriv_request_sample().

15 months agoavcodec/exr: Check line size for overflow
Michael Niedermayer [Sat, 26 Sep 2020 20:04:16 +0000 (22:04 +0200)]
avcodec/exr: Check line size for overflow

Fixes: signed integer overflow: 570425356 * 6 cannot be represented in type 'int
Fixes: 25929/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5099197739827200

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/exr: Check xdelta, ydelta
Michael Niedermayer [Sat, 26 Sep 2020 19:54:36 +0000 (21:54 +0200)]
avcodec/exr: Check xdelta, ydelta

Fixes: assertion failure
Fixes: 25617/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_EXR_fuzzer-5648746061496320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/adpcm: Check block align for AV_CODEC_ID_ADPCM_PSX
Michael Niedermayer [Tue, 29 Sep 2020 19:23:39 +0000 (21:23 +0200)]
avcodec/adpcm: Check block align for AV_CODEC_ID_ADPCM_PSX

Regression since: ca49476ace90ddebc5f92d9d82297f77e528c21e
Fixes: out of array write
Fixes: 25786/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_ADPCM_PSX_fuzzer-5704869380620288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/mobiclip: Fix multiple integer overflows
Michael Niedermayer [Tue, 29 Sep 2020 20:43:13 +0000 (22:43 +0200)]
avcodec/mobiclip: Fix multiple integer overflows

Fixes: signed integer overflow: 872415232 * 7 cannot be represented in type 'int'
Fixes: signed integer overflow: -2013265888 + -1744830464 cannot be represented in type 'int'
Fixes: 25834/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MOBICLIP_fuzzer-5471406434025472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoAllow using only the mfra info for seeking using the fragment index
Justin Ruggles [Fri, 2 Oct 2020 12:51:19 +0000 (08:51 -0400)]
Allow using only the mfra info for seeking using the fragment index

The mfra has enough information to enable seeking, and reading it is
behind an AVOption flag, so we shouldn't require that sidx information
also be present in order to seek using the fragment index.

Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
15 months agoswscale/utils: override forced-zero formats back to full range
Jan Ekström [Fri, 9 Oct 2020 22:33:27 +0000 (01:33 +0300)]
swscale/utils: override forced-zero formats back to full range

Fixes vf_scale outputting RGB AVFrames with limited range flagged
in case either input or output specifically sets the range.

This is the reverse of the logic utilized for RGB and PAL8 content
in sws_setColorspaceDetails.

15 months agoswscale/utils: split range override check into its own function
Jan Ekström [Fri, 9 Oct 2020 22:29:18 +0000 (01:29 +0300)]
swscale/utils: split range override check into its own function

15 months agoavfilter/avfilter.h: add missing FF_API_NEXT wrapper
James Almer [Sun, 11 Oct 2020 02:54:35 +0000 (23:54 -0300)]
avfilter/avfilter.h: add missing FF_API_NEXT wrapper

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoavformat/avformat.h: add missing FF_API_NEXT wrappers
James Almer [Sun, 11 Oct 2020 02:54:17 +0000 (23:54 -0300)]
avformat/avformat.h: add missing FF_API_NEXT wrappers

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoavcodec/codec.h: add missing FF_API_NEXT wrapper
James Almer [Sun, 11 Oct 2020 02:54:03 +0000 (23:54 -0300)]
avcodec/codec.h: add missing FF_API_NEXT wrapper

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoavcodec/vp9: Fix stack-buffer overflow with VP9 VDPAU available
Andreas Rheinhardt [Sat, 10 Oct 2020 23:29:57 +0000 (01:29 +0200)]
avcodec/vp9: Fix stack-buffer overflow with VP9 VDPAU available

ccca62ef991f0a47dfa30c3e822d91294b8afe4c added new VP9 VDPAU profiles
and as a consequence AV_PIX_FMT_VDPAU can now be twice in the list of
pixel formats used for format negotiation by ff_thread_get_format(); yet
there is only one entry in said list reserved for VDPAU, leading to a
stack-buffer overflow. This commit fixes this by making sure that
AV_PIX_FMT_VDPAU will not occur twice in said list.

Fixes Coverity ticket 1468046.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/sheervideo: Avoid code duplication when creating VLC tables
Andreas Rheinhardt [Sat, 10 Oct 2020 18:28:16 +0000 (20:28 +0200)]
avcodec/sheervideo: Avoid code duplication when creating VLC tables

The SheerVideo decoder uses two VLC tables and these are in turn created
from structures (called SheerTable) that are naturally paired. This
commit unifies these pairs of SheerTables to arrays and unifies creating
the VLC tables.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/sheervideo: Reduce the size of static arrays
Andreas Rheinhardt [Sat, 10 Oct 2020 15:47:54 +0000 (17:47 +0200)]
avcodec/sheervideo: Reduce the size of static arrays

The SheerVideo decoder uses VLC tables which are currently stored in
large arrays that contain the length of each leaf of the corresponding
tree from left to right, taking 15.5KB of space. But all these arrays
follow a common pattern: First the entries are ascending and then they
are descending with lots of successive entries have the same value.
Therefore it makes sense to use a run-length encoding to store them, as
this commit does. Notice that the length 16 has to be treated specially
because there are arrays with more than 256 consecutive entries with
value 16 and because the length of the entries start to descend from
this length onward.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/sheervideo: Don't leave context in inconsistent state upon error
Andreas Rheinhardt [Sat, 10 Oct 2020 18:11:49 +0000 (20:11 +0200)]
avcodec/sheervideo: Don't leave context in inconsistent state upon error

This has happened if the format changed midstream and if the new packet
is so small that it is instantaneously rejected: In this case the VLC
tables were for the new format, although the context says that they are
still the ones for the old format. It can also happen if the format
changed midstream and the allocation of the new tables fails. If the
next packet is a packet for the old format, the decoder thinks it
already has the correct VLC tables, leading to a segfault.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/sheervideo: Inline compile-time constants
Andreas Rheinhardt [Sat, 10 Oct 2020 04:45:01 +0000 (06:45 +0200)]
avcodec/sheervideo: Inline compile-time constants

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/sheervideo: Improve creating VLC tables
Andreas Rheinhardt [Sat, 10 Oct 2020 04:13:21 +0000 (06:13 +0200)]
avcodec/sheervideo: Improve creating VLC tables

Don't needlessly copy an array around; don't create a table with
default symbols; and use smaller types to save stack space: The longest
code here is 16 bits, so one can store the codes in this type.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()
Michael Niedermayer [Wed, 23 Sep 2020 21:31:59 +0000 (23:31 +0200)]
avcodec/celp_filters: Avoid invalid negation in ff_celp_lp_synthesis_filter()

Fixes: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
Fixes: 25675/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_G729_fuzzer-4786580731199488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/takdsp: Fix negative shift in decorrelate_sf()
Michael Niedermayer [Thu, 24 Sep 2020 19:59:04 +0000 (21:59 +0200)]
avcodec/takdsp: Fix negative shift in decorrelate_sf()

Fixes: left shift of negative value -4
Fixes: 25723/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TAK_fuzzer-6250580752990208

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agofate: Add aa-demux test
Michael Niedermayer [Tue, 15 Sep 2020 15:13:36 +0000 (17:13 +0200)]
fate: Add aa-demux test

This should help fuzzer coverage

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
15 months agoavcodec/parsers: add missing FF_API_NEXT wrappers
James Almer [Sat, 10 Oct 2020 04:12:01 +0000 (01:12 -0300)]
avcodec/parsers: add missing FF_API_NEXT wrappers

Signed-off-by: James Almer <jamrial@gmail.com>
15 months agoavcodec/mpeg12dec: Optimize reading mpeg2 intra escape codes
Andreas Rheinhardt [Thu, 8 Oct 2020 19:45:21 +0000 (21:45 +0200)]
avcodec/mpeg12dec: Optimize reading mpeg2 intra escape codes

Said escape code is only six bits long, so that one has at least 25 - 6
bits in the bitstream reader's cache after reading it; therefore the
whole following 18 bits (containing the actual code) are already in the
bitstream reader's cache, making it unnecessary to reload the cache.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavformat/aviobuf: increase default read buffer size to 2*max_buffer_size for streamed...
Marton Balint [Sat, 19 Sep 2020 22:02:19 +0000 (00:02 +0200)]
avformat/aviobuf: increase default read buffer size to 2*max_buffer_size for streamed data

This should increase the effectiveness of ffio_ensure_seekback by reducing the
number of buffer reallocations and memmoves/memcpys because even a small
seekback window requires max_buffer_size+window_size buffer space.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: fix indentation
Marton Balint [Mon, 28 Sep 2020 22:16:47 +0000 (00:16 +0200)]
avformat/aviobuf: fix indentation

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: do not allocate a new buffer in ffio_ensure_seekback if not needed
Marton Balint [Mon, 28 Sep 2020 22:15:27 +0000 (00:15 +0200)]
avformat/aviobuf: do not allocate a new buffer in ffio_ensure_seekback if not needed

Let's move unread data to the start of the old buffer instead.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: discard part of the IO buffer in ffio_ensure_seekback if needed
Marton Balint [Mon, 28 Sep 2020 21:48:34 +0000 (23:48 +0200)]
avformat/aviobuf: discard part of the IO buffer in ffio_ensure_seekback if needed

Previously ffio_ensure_seekback never flushed the buffer, so successive
ffio_ensure_seekback calls were all respected. This could eventually cause
unlimited memory and CPU usage if a demuxer called ffio_ensure_seekback on all
it's read data.

Most demuxers however only rely on being able to seek back till the position of
the last ffio_ensure_seekback call, therefore we change the semantics of
ffio_ensure_seekback so that a new call can invalidate seek guarantees of the
old. In order to support some level of "nested" ffio_ensure_seekback calls, we
document that the function only invalidates the old window (and potentially
discards the already read data from the IO buffer), if the newly requested
window does not fit into the old one.

This way we limit the memory usage for ffio_ensure_seekback calls requesting
consecutive data windows.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/mpjpegdec: make sure we seek back to the ensured buffer
Marton Balint [Sat, 26 Sep 2020 18:36:25 +0000 (20:36 +0200)]
avformat/mpjpegdec: make sure we seek back to the ensured buffer

It was possible for the old code to seek back before the most recently read
data if start of a new multipart was across read boundaries. Now we read some
small sections multiple times to avoid this, but that is OK.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/mpegts: make sure mpegts_resync do not run out of the initially requested...
Marton Balint [Sat, 26 Sep 2020 18:30:27 +0000 (20:30 +0200)]
avformat/mpegts: make sure mpegts_resync do not run out of the initially requested probe buffer

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: fix checks in ffio_ensure_seekback
Marton Balint [Sat, 19 Sep 2020 22:01:48 +0000 (00:01 +0200)]
avformat/aviobuf: fix checks in ffio_ensure_seekback

The new buf_size was detemined too conservatively, maybe because of the
off-by-one issue which was fixed recently in fill_buffer. We can safely
substract 1 more from the new buffer size, because max_buffer_size space must
only be guaranteed when we are reading the last byte of the requested window.

Comparing the new buf_size against filled did not make a lot of sense, what
makes sense is that we want to reallocate the buffer if the new buf_size is
bigger than the old, therefore the change in the check.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: check if requested seekback buffer is already read
Marton Balint [Sat, 26 Sep 2020 17:20:50 +0000 (19:20 +0200)]
avformat/aviobuf: check if requested seekback buffer is already read

Existing code did not check if the requested seekback buffer is
already read entirely. In this case, nothing has to be done to guarantee
seekback.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavformat/aviobuf: write data into the IO buffer till the very end of the buffer
Marton Balint [Sun, 20 Sep 2020 07:32:44 +0000 (09:32 +0200)]
avformat/aviobuf: write data into the IO buffer till the very end of the buffer

There was an off-by-one error when checking if the IO buffer still has enough
space till the end. One more byte can be safely written.

Signed-off-by: Marton Balint <cus@passwd.hu>
15 months agoavfilter/vf_minterpolate: Remove redundant code for freeing
Andreas Rheinhardt [Tue, 6 Oct 2020 13:10:43 +0000 (15:10 +0200)]
avfilter/vf_minterpolate: Remove redundant code for freeing

ad73b32d2922f4237405043d19763229aee0e59e added some code for freeing in
the input's config_props function, yet this is unnecessary as uninit is
called anyway if config_props fails.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavfilter/vf_minterpolate: Fix left shift of negative value
Andreas Rheinhardt [Tue, 6 Oct 2020 12:52:11 +0000 (14:52 +0200)]
avfilter/vf_minterpolate: Fix left shift of negative value

This has happened when initializing the motion estimation context if
width or height of the video was smaller than the block size used
for motion estimation and if the motion interpolation mode indicates
not to use motion estimation.

The solution is of course to only initialize the motion estimation
context if the interpolation mode uses motion estimation.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavfilter/vf_minterpolate: Reject too small dimensions
Andreas Rheinhardt [Tue, 6 Oct 2020 12:35:25 +0000 (14:35 +0200)]
avfilter/vf_minterpolate: Reject too small dimensions

The latter code relies upon the dimensions to be not too small;
otherwise one will call av_clip() with min > max lateron which aborts
in case ASSERT_LEVEL is >= 2 or one will get a nonsense result that may
lead to a heap-buffer-overflow/underflow. The latter has happened in
ticket #8248 which this commit fixes.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavformat/rtsp: allocate correct max number of pollfds
Andriy Gelman [Sat, 26 Sep 2020 22:26:30 +0000 (18:26 -0400)]
avformat/rtsp: allocate correct max number of pollfds

There is one general rtsp connection plus two connections per stream (rtp/rtcp).

Reviewed-by: Zhao Zhili <zhilizhao@tencent.com>
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
15 months agoavformat/rtspdec: add newline in log message
Andriy Gelman [Sat, 26 Sep 2020 22:26:29 +0000 (18:26 -0400)]
avformat/rtspdec: add newline in log message

Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
15 months agoFATE/dnn: only run unit test when CONFIG_DNN enabled
Peter Ross [Thu, 8 Oct 2020 11:00:56 +0000 (22:00 +1100)]
FATE/dnn: only run unit test when CONFIG_DNN enabled

Signed-off-by: Peter Ross <pross@xvid.org>
Reviewed-by: Guo, Yejun <yejun.guo@intel.com>
15 months agoavcodec/magicyuvenc: Use more correct cast in compare function
Andreas Rheinhardt [Thu, 8 Oct 2020 19:14:28 +0000 (21:14 +0200)]
avcodec/magicyuvenc: Use more correct cast in compare function

There is no need to cast const away (even if it was harmless) and to
copy the object at all.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/magicyuvenc: Avoid sorting Huffman table unnecessarily
Andreas Rheinhardt [Mon, 28 Sep 2020 13:11:52 +0000 (15:11 +0200)]
avcodec/magicyuvenc: Avoid sorting Huffman table unnecessarily

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/mjpegdec: Remove redundant initialization
Andreas Rheinhardt [Thu, 8 Oct 2020 18:08:12 +0000 (20:08 +0200)]
avcodec/mjpegdec: Remove redundant initialization

Now that the correct number of codes is used, it is no longer necessary
to initialize the lengths of the codes at all any more as the length of
the actually used codes is set later anyway.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/mjpegdec: Remove use_static from build_vlc()
Andreas Rheinhardt [Thu, 8 Oct 2020 18:02:17 +0000 (20:02 +0200)]
avcodec/mjpegdec: Remove use_static from build_vlc()

It is always zero; it referred to the INIT_VLC_USE_STATIC flag which has
been removed in 595324e143b57a52e2329eb47b84395c70f93087.

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavformat/libopenmpt: Don't discard const
Andreas Rheinhardt [Thu, 8 Oct 2020 13:46:06 +0000 (15:46 +0200)]
avformat/libopenmpt: Don't discard const

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/mjpegdec: Use correct number of codes when init default VLCs
Andreas Rheinhardt [Thu, 8 Oct 2020 17:35:02 +0000 (19:35 +0200)]
avcodec/mjpegdec: Use correct number of codes when init default VLCs

Commit bbc0d0c1fe2b7ecdc4367295594f084f85ad22f5 made the mjpeg decoder
use default Huffman tables when none are given, yet when initializing
the default Huffman tables, it did not use the correct number of entries
of the arrays used to initialize the tables, but instead it used the
biggest entry + 1 (as if it were a continuous array 0..biggest entry).
This worked because the ff_init_vlc_sparse() (and its predecessors)
always skipped entries with a length of zero and the length of the
corresponding elements was always initialized to zero with only the
sizes of the actually existing elements being set to a size > 0 lateron.

Yet since commit 1249698e1b424cff8e77e6a83cfdbc9d11e01aa7 this is no
longer so, as build_vlc() actually read the array containing the values
itself. This implies that the wrong length now leads to a read beyond
the end of the given array; this could lead to crashs (but usually
doesn't); it is detectable by ASAN* and this commit fixes it.

*: AddressSanitizer: global-buffer-overflow on address xy
...
xy is located 0 bytes to the right of global variable 'avpriv_mjpeg_val_ac_luminance'

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoavcodec/mjpegdec: Use correct number of codes for VLC tables
Andreas Rheinhardt [Thu, 8 Oct 2020 17:22:35 +0000 (19:22 +0200)]
avcodec/mjpegdec: Use correct number of codes for VLC tables

Commit 1249698e1b424cff8e77e6a83cfdbc9d11e01aa7 made
ff_mjpeg_decode_dht() call build_vlc() with a wrong (too hight)
number of codes. The reason it worked is that the lengths of the extraneous
entries is initialized to zero and ff_init_vlc_sparse() ignores codes
with a length of zero. But using a too high number of codes was
nevertheless bad, because a) the assert in build_vlc() could have been
triggered (namely if the real amount of codes is 256) and b) the loop in
build_vlc() uses initialized data (leading to Valgrind errors [1]).
Furthermore, the old code spend CPU cycles in said loop although the
result won't be used anyway.

[1]: http://fate.ffmpeg.org/report.cgi?slot=x86_64-archlinux-gcc-valgrind&time=20201008025137

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoVP9 Profile 2 VDPAU support
ManojGuptaBonda [Thu, 8 Oct 2020 06:18:51 +0000 (11:48 +0530)]
VP9 Profile 2 VDPAU support

Added VDPAU to list of supported formats for VP9 420 10 and 12 bit
formats. Add VP9 10/12 Bit support for VDPAU

Signed-off-by: Philip Langdale <philipl@overt.org>
15 months agoavformat/dashdec: Reset pointer to NULL after freeing it
Andreas Rheinhardt [Thu, 8 Oct 2020 13:40:02 +0000 (15:40 +0200)]
avformat/dashdec: Reset pointer to NULL after freeing it

This is currently safe here, because the effective lifetime of
adaptionset_lang is parse_manifest_adaptationset() (i.e. the pointer
gets overwritten each time on entry to the function and gets freed
before exiting the function), but it is nevertheless safer to reset the
pointer.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
15 months agoconfigure: add missing atsc_a53 dependencies to hevcparse and h264_parser
James Almer [Thu, 8 Oct 2020 13:09:39 +0000 (10:09 -0300)]
configure: add missing atsc_a53 dependencies to hevcparse and h264_parser

Found-by: Chris Miceli <chris@miceli.net.au>
Signed-off-by: James Almer <jamrial@gmail.com>
15 months agolibavformat/dashdec: Fix issue with dash on Windows
Christopher Degawa [Thu, 8 Oct 2020 12:45:21 +0000 (12:45 +0000)]
libavformat/dashdec: Fix issue with dash on Windows

Use xmlFree instead of av_freep

snip from libxml2:

 * xmlGetProp:
...
 * Returns the attribute value or NULL if not found.
 *     It's up to the caller to free the memory with xmlFree().

According to libxml2, you are supposed to use xmlFree instead of free
on the pointer returned by it, and also using av_freep on Windows will
call _aligned_free instead of normal free, causing _aligned_free to raise
SIGTRAP and crashing ffmpeg and ffplay.

Signed-off-by: Christopher Degawa <ccom@randomderp.com>
15 months agolavf/img2dec: Auto-detect Cintel scanner images.
Carl Eugen Hoyos [Thu, 8 Oct 2020 07:34:55 +0000 (09:34 +0200)]
lavf/img2dec: Auto-detect Cintel scanner images.

15 months agoavcodec/mjpegdec: improve decoding of DNG files
Paul B Mahol [Sat, 3 Oct 2020 12:34:01 +0000 (14:34 +0200)]
avcodec/mjpegdec: improve decoding of DNG files

That have unused symbols coded in DHT.

15 months agoavcodec/tiff: do not abort decoding if strips are available
Paul B Mahol [Fri, 2 Oct 2020 10:16:49 +0000 (12:16 +0200)]
avcodec/tiff: do not abort decoding if strips are available

Even if such files are invalid, they can be decoded just fine.
Also stored tiles may have bigger dimensions than displayed ones,
so do not abort decoding in such cases.